多款Siemens产品 安全漏洞

The Nucleus NET module contains a range of standards-compliant networking and communications protocols, drivers and utilities to provide full-featured networking support in any embedded device. A security vulnerability exists in Siemens Nucleus NET. An attacker could exploit the vulnerability to...

Security Updates for Microsoft SharePoint Server 2019 (January 2021)

The Microsoft SharePoint Server 2019 installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - A session spoofing vulnerability exists. An attacker can exploit this to perform actions with the privileges of another user. CVE-2021-1641,...

Security Updates for Microsoft SharePoint Server 2016 (January 2021)

The Microsoft SharePoint Server 2016 installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - A session spoofing vulnerability exists. An attacker can exploit this to perform actions with the privileges of another user. CVE-2021-1641,...

Security Updates for Microsoft SharePoint Server 2013 (January 2021)

The Microsoft SharePoint Server 2013 installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - A session spoofing vulnerability exists. An attacker can exploit this to perform actions with the privileges of another user. CVE-2021-1641,...

Security Updates for Microsoft SharePoint Server 2010 (December 2020)

The Microsoft SharePoint Server 2010 installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities : - An elevation of privilege vulnerability. An attacker can exploit this to gain elevated privileges. CVE-2020-17089 - An information disclosur...

Security Updates for Microsoft SharePoint Server 2019 (December 2020)

The Microsoft SharePoint Server 2019 installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities : - An elevation of privilege vulnerability. An attacker can exploit this to gain elevated privileges. CVE-2020-17089 - A remote code execution...

Security Updates for Microsoft SharePoint Server 2013 (December 2020)

The Microsoft SharePoint Server 2013 installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities : - An elevation of privilege vulnerability. An attacker can exploit this to gain elevated privileges. CVE-2020-17089 - A remote code execution...

Security Updates for Microsoft SharePoint Server 2016 (December 2020)

The Microsoft SharePoint Server 2016 installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities : - An elevation of privilege vulnerability. An attacker can exploit this to gain elevated privileges. CVE-2020-17089 - A remote code execution...

CVE-2020-1762

CVE-2020-1762 affects Kiali versions 0.4.0 to 1.15.0; root cause is insufficient JWT validation. An attacker could steal a valid JWT cookie and use it to spoof a user session, potentially gaining privileges to view and alter Istio configuration. The issue was fixed in Kiali 1.15.1. Remediation is...

PT-2020-15041 · Istio · Istio

Name of the Vulnerable Software and Affected Versions: Kiali versions 0.4.0 through 1.15.0 Description: The issue is related to insufficient JWT validation, allowing a remote attacker to steal a valid JWT cookie and use it to spoof a user session. This could potentially grant privileges to view a...

Kiali has an unspecified vulnerability

Kiali is an open source, visual management tool for the Istio microservices architecture. A security vulnerability exists in kiali, which can be exploited by a remote attacker to gain privileges, view and modify the Istio configuration by stealing a valid JWT cookie and spoofing a user session...

kiali: ignoring JWT claim fields

An insufficient JWT validation vulnerability was found in Kiali, versions 0.4.0 to 1.15.0. A remote attacker could abuse this flaw by stealing a valid JWT cookie and using that to spoof a user session, possibly gaining privileges to view and alter the Istio configuration...

UBUNTU-CVE-2019-18625

An issue was discovered in Suricata 5.0.0. It was possible to bypass/evade any tcp based signature by faking a closed TCP session using an evil server. After the TCP SYN packet, it is possible to inject a RST ACK and a FIN ACK packet with a bad TCP Timestamp option. The client will ignore the RST...

systemd - Lack of Seat Verification in PAM Module Permits Spoofing Active Session to polkit

systemd - Lack of Seat Verification in PAM Module Permits Spoofing Active Session to polkit As documented at , for any action, a polkit policy can specify separate levels of required authentication based on whether a client is: - in an active session on a local console - in an inactive session on...

Information Disclosure in GlobalProtect App

An information disclosure vulnerability exists in the GlobalProtect App for Windows and macOS VU192371. Successful exploitation of this issue would allow a local authenticated attacker to access authentication and/or session tokens and replay them to spoof the VPN session and gain access as the...

CVE-2019-3784

Cloud Foundry Stratos, versions prior to 2.3.0, contains an insecure session that can be spoofed. When deployed on cloud foundry with multiple instances using the default embedded SQLite database, a remote authenticated malicious user can switch sessions to another user with the same session id...

Security Bulletin: Multiple vulnerabilities in cURL libcURL affect IBM Tivoli Netcool System Service Monitors/Application Service Monitors (CVE-2014-8150, 2014-8151)

Summary There are multiple vulnerabilities in cURL libcURL that is used by IBM Tivoli Netcool System Service Monitors/Application Service Monitors. These issues were disclosed on January 8, 2015 by the cURL libcURL Project. Vulnerability Details CVE-ID: CVE-2014-8150 DESCRIPTION: libcURL is...

CVE-2016-0339

IBM Security Identity Manager ISIM Virtual Appliance 7.0.0.0 through 7.0.1.1 before 7.0.1-ISS-SIM-FP0003 mishandles session identifiers after logout, which makes it easier for remote attackers to spoof users by leveraging knowledge of "traffic records."...

CVE-2014-9201

Beckwith Electric M-6200 Digital Voltage Regulator Control with firmware before D-0198V04.07.00, M-6200A Digital Voltage Regulator Control with firmware before D-0228V02.01.07, M-2001D Digital Tapchanger Control with firmware before D-0214V01.10.04, M-6283A Three Phase Digital Capacitor Bank...

CVE-2014-9201

Beckwith Electric M-6200 Digital Voltage Regulator Control with firmware before D-0198V04.07.00, M-6200A Digital Voltage Regulator Control with firmware before D-0228V02.01.07, M-2001D Digital Tapchanger Control with firmware before D-0214V01.10.04, M-6283A Three Phase Digital Capacitor Bank...